COLDCARD RNG incident the public record, collected and explained
Informational only, and this site never asks for your seed words. details

Informational only. This is an open source collection of what others have published about the incident, together with an explanation of it. It is not financial, security or legal advice, and not a substitute for professional advice about your own situation. It is not affiliated with, endorsed by, or speaking for Coinkite. Material is attributed and quoted as published; where sources disagree their scenarios are kept separate with their assumptions rather than reconciled into one answer. Everything is meant to be checked against the linked evidence rather than taken on trust. Act on your own judgement about a particular situation. Editorial standards and corrections.

Do not disclose recovery material to a website, form, message or support account. This site never asks for it, and contributions containing recovery words or private keys are not accepted.

Pleb Economist #13: ColdCard and the Law of Large Numbers

stackernews-pleb-economist-13

https://stacker.news/items/1537022

Organisation
Stacker News
Evidence role
Community discussion
Published
2026-07-31
Source changes
0
Detected differences
0
Unreviewed
0
Copies held
1

SimpleStacker's Pleb Economist column on the incident and the law of large numbers: with enough users, rare weak-entropy events become certainties. Opinion, attributed to the author. Captured through the site's public GraphQL API: the rendered pages crash the capture tab, and the API answers POST from this host. The query fixes the captured surface to the item's title, text and two levels of comments, each with author and absolute timestamp.

Every check is recorded, including checks that found no text change. A detected edit is therefore bounded between two checks. The publisher's exact save time is not observable from this record. Last checked .

  1. Earliest copy held Current
    seen · Captured here 9,960 chars
    Extracted text as captured
    {
      "data": {
        "item": {
          "comments": {
            "comments": [
              {
                "createdAt": "2026-07-31T15:20:02.436Z",
                "text": "One of the big reasons for not “doing the rational thing” is saliency. \n\nThe assumption that somebody would have found the vulnerability if it existed is framed incorrectly. The better assumption would be that if there were a sufficiently easy to find vulnerability it would have been found. \n\nThat second framing still isn’t a correct assumption but it includes the important concept that finding vulnerabilities is a function of both the difficulty of finding them and the payoff for finding them. \n\nOther things equal, we should expect more vulnerabilities to be found when NGU and when technology improves for attacking systems.",
                "user": {
                  "name": "Undisciplined"
                }
              },
              {
                "createdAt": "2026-07-31T16:00:49.214Z",
                "text": "> The answer has to be: not enough people were actually looking at it.  Bitcoin is a small community, and everyone is busy with their own things.  Very few people are spending the time to audit code.\n\nTotally... it's like we need more devs, and more dev funding! Maybe, like, a consortium?\n\n---\n\nRe: the law of large numbers and economics, I don't think that's quite true -- _neither_ in the business competition setting nor, _especially_ in the EMH domain. For, say, closing an arbitrage it only takes one guy (at sometimes a lot of capital). \n\nSubject to network effects and switching costs (maybe a new competitor _is_ better/not as shitty as previous dude) but it takes effort and work to switch; also, the EMH literature is littered with examples of constraints on shorting or completing the arbitrage cycle and so on. \n\nNone require _a lot of random people_ looking at them; only a select, entrepreneurial few, motivated enough. \n\n--- \n\nput differently, in your Coldcard example, it'd be like devs (for the company, or generally) had a $100k outstanding bonus if/when they found a critical bug. Don't think they do?",
                "user": {
                  "name": "denlillaapan"
                }
              },
              {
                "createdAt": "2026-07-31T15:41:25.772Z",
                "text": "Thanks. Sobering.\n\n> Bitcoin relies on game theoretic security.  Game theoretic security relies on assumptions about how people behave according to their incentives. ... Most people are not paying attention all the time.\n\nI'd also add that most people simply don't have the time or resources to both survive and pay attention, even some of the time.\n\nThis is easily the strongest argument for bitcoin's success not being inevitable. We've got heavy lifting to do!",
                "user": {
                  "name": "jasonb"
                }
              },
              {
                "createdAt": "2026-07-31T16:19:25.481Z",
                "text": "Fable: \"This chat has been routed to Opus\"\n\nChatGPT:  \"I can't help with that\"\n\nKimi K3 (probably): \"They used #ifndef MICROPY_HW_ENABLE_RNG  and not #if MICROPY_HW_ENABLE_RNG == 0\"",
                "user": {
                  "name": "OneOneSeven"
                }
              },
              {
                "createdAt": "2026-07-31T16:55:32.686Z",
                "text": "🔗 Privacy-friendly: https://invidious.f5.si/watch?v=P3K70rkaCJc",
                "user": {
                  "name": "YewTuBot"
                }
              },

    Excerpt only. The complete copy is held offline and backs quotations on this site. The original publication remains the canonical public source.

How to check this yourself

The excerpts and plain unified diffs above show the text this project held and how it changed. To verify a quotation, compare it against the page itself or against the Internet Archive's copies, which are independent of this project.

Complete captures are held offline rather than mirrored here, so this page shows diffs and excerpts. If a quotation is ever disputed, the full copy can be produced. Ask.